sync: master to main#69

Open

github-actions[bot] wants to merge 2674 commits into

mainfrom

GitHub Advanced Security / CodeQL failed Jun 9, 2026 in 3s

10 new alerts including 2 critical severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

2 critical
2 high
6 medium

Alerts not introduced by this pull request might have been detected because the code changes were too large.

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 19505 in docs/assets/js/asciinema-player.js

Code scanning / CodeQL

Useless regular-expression character escape High documentation

The escape sequence '\b' is a backspace, and not a word-boundary assertion when it is used in a

.

Check failure on line 65 in packages/changelog/src/index.ts

Code scanning / CodeQL

Uncontrolled command line Critical

This command line depends on a

.

Check failure on line 80 in packages/changelog/src/index.ts

Code scanning / CodeQL

Uncontrolled command line Critical

This command line depends on a

.

Check failure on line 43 in packages/github-client/src/index.ts

Code scanning / CodeQL

Potential file system race condition High

The file may have changed since it

.

Check warning on line 7 in datas.html

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium

Script loaded from content delivery network with no integrity check.

Check warning on line 8 in datas.html

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium

Script loaded from content delivery network with no integrity check.

Check warning on line 148 in docs/assets/js/asciinema-player.js

Code scanning / CodeQL

Missing origin verification in `postMessage` handler Medium documentation

Postmessage handler has no origin check.

Check warning on line 49 in docs/overrides/addons/base.html

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium documentation

Script loaded from content delivery network with no integrity check.

Check warning on line 51 in docs/overrides/addons/base.html

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium documentation

Script loaded from content delivery network with no integrity check.

Check warning on line 99 in packages/contributors-view/src/index.ts

Code scanning / CodeQL

Log injection Medium

Log entry depends on a

.